- ref={tableRef}
- // @ts-expect-error update types
- // eslint-disable-next-line react-perf/jsx-no-new-array-as-prop
- items={data.agents ?? []}
- itemId="_id"
- columns={columns}
- pagination={pagination}
- sorting={sorting}
- isSelectable={true}
- selection={selection}
- onChange={onTableChange}
- rowHeader="firstName"
- />
+
+
{SELECT_AGENT_LABEL}
+ {numAgentsSelected > 0 ? {generateSelectedAgentsMessage(numAgentsSelected)} : ''}
+
+
+
);
};
diff --git a/x-pack/plugins/osquery/public/agents/helpers.test.ts b/x-pack/plugins/osquery/public/agents/helpers.test.ts
new file mode 100644
index 0000000000000..3efd1b877d1a0
--- /dev/null
+++ b/x-pack/plugins/osquery/public/agents/helpers.test.ts
@@ -0,0 +1,222 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getNumOverlapped, getNumAgentsInGrouping, processAggregations } from './helpers';
+import { Overlap, SelectedGroups } from './types';
+
+describe('processAggregations', () => {
+ it('should handle empty inputs properly', () => {
+ const input = {};
+ const { platforms, policies, overlap } = processAggregations(input);
+ expect(platforms).toEqual([]);
+ expect(policies).toEqual([]);
+ expect(overlap).toEqual({});
+ });
+ it('should handle platforms with no policies', () => {
+ const input = {
+ platforms: {
+ buckets: [
+ {
+ key: 'darwin',
+ doc_count: 200,
+ policies: {
+ buckets: [],
+ },
+ },
+ ],
+ },
+ };
+ const { platforms, policies, overlap } = processAggregations(input);
+ expect(platforms).toEqual([
+ {
+ name: 'darwin',
+ size: 200,
+ },
+ ]);
+ expect(policies).toEqual([]);
+ expect(overlap).toEqual({});
+ });
+ it('should handle policies with no platforms', () => {
+ const input = {
+ policies: {
+ buckets: [
+ {
+ key: '8cd01a60-8a74-11eb-86cb-c58693443a4f',
+ doc_count: 100,
+ },
+ {
+ key: '8cd06880-8a74-11eb-86cb-c58693443a4f',
+ doc_count: 100,
+ },
+ ],
+ },
+ };
+ const { platforms, policies, overlap } = processAggregations(input);
+ expect(platforms).toEqual([]);
+ expect(policies).toEqual([
+ {
+ name: '8cd01a60-8a74-11eb-86cb-c58693443a4f',
+ size: 100,
+ },
+ {
+ name: '8cd06880-8a74-11eb-86cb-c58693443a4f',
+ size: 100,
+ },
+ ]);
+ expect(overlap).toEqual({});
+ });
+ it('should parse aggregation responses down into metadata objects', () => {
+ const input = {
+ policies: {
+ buckets: [
+ {
+ key: '8cd01a60-8a74-11eb-86cb-c58693443a4f',
+ doc_count: 100,
+ },
+ {
+ key: '8cd06880-8a74-11eb-86cb-c58693443a4f',
+ doc_count: 100,
+ },
+ ],
+ },
+ platforms: {
+ buckets: [
+ {
+ key: 'darwin',
+ doc_count: 200,
+ policies: {
+ buckets: [
+ {
+ key: '8cd01a60-8a74-11eb-86cb-c58693443a4f',
+ doc_count: 100,
+ },
+ {
+ key: '8cd06880-8a74-11eb-86cb-c58693443a4f',
+ doc_count: 100,
+ },
+ ],
+ },
+ },
+ ],
+ },
+ };
+ const { platforms, policies, overlap } = processAggregations(input);
+ expect(platforms).toEqual([
+ {
+ name: 'darwin',
+ size: 200,
+ },
+ ]);
+ expect(policies).toEqual([
+ {
+ name: '8cd01a60-8a74-11eb-86cb-c58693443a4f',
+ size: 100,
+ },
+ {
+ name: '8cd06880-8a74-11eb-86cb-c58693443a4f',
+ size: 100,
+ },
+ ]);
+ expect(overlap).toEqual({
+ darwin: {
+ '8cd06880-8a74-11eb-86cb-c58693443a4f': 100,
+ '8cd01a60-8a74-11eb-86cb-c58693443a4f': 100,
+ },
+ });
+ });
+});
+
+describe('getNumAgentsInGrouping', () => {
+ it('should handle empty objects', () => {
+ const selectedGroups: SelectedGroups = {};
+ expect(getNumAgentsInGrouping(selectedGroups)).toEqual(0);
+ });
+
+ it('should add up the quantities for the selected groups', () => {
+ const selectedGroups: SelectedGroups = {
+ platform: {
+ linux: 35,
+ },
+ policy: {
+ policy_id1: 40,
+ },
+ };
+ expect(getNumAgentsInGrouping(selectedGroups)).toEqual(75);
+ });
+});
+
+describe('getNumOverlapped', () => {
+ const overlap: Overlap = {
+ darwin: {
+ policy_id1: 15,
+ policy_id2: 35,
+ },
+ linux: {
+ policy_id1: 25,
+ policy_id2: 10,
+ },
+ };
+
+ it('should add up the quantities associated with a platform/policy selection', () => {
+ const selectedGroups: SelectedGroups = {
+ platform: {
+ linux: 35,
+ },
+ policy: {
+ policy_id1: 40,
+ },
+ };
+
+ const computedOverlap = getNumOverlapped(selectedGroups, overlap);
+ expect(computedOverlap).toBe(25);
+ });
+
+ it('should gracefully handle empty objects', () => {
+ const selectedGroups: SelectedGroups = {};
+
+ const computedOverlap = getNumOverlapped(selectedGroups, overlap);
+ expect(computedOverlap).toBe(0);
+ });
+
+ it('should gracefully handle missing platforms', () => {
+ const selectedGroups: SelectedGroups = {
+ policy: {
+ policy_id1: 40,
+ policy_id3: 40,
+ },
+ };
+ const computedOverlap = getNumOverlapped(selectedGroups, overlap);
+ expect(computedOverlap).toBe(0);
+ });
+
+ it('should gracefully handle missing policies', () => {
+ const selectedGroups: SelectedGroups = {
+ platform: {
+ linux: 35,
+ windows: 40,
+ },
+ };
+ const computedOverlap = getNumOverlapped(selectedGroups, overlap);
+ expect(computedOverlap).toBe(0);
+ });
+
+ it('should gracefully handle missing group selections', () => {
+ const selectedGroups: SelectedGroups = {
+ platform: {
+ linux: 35,
+ windows: 40,
+ },
+ policy: {
+ policy_id1: 40,
+ policy_id3: 40,
+ },
+ };
+
+ const computedOverlap = getNumOverlapped(selectedGroups, overlap);
+ expect(computedOverlap).toBe(25);
+ });
+});
diff --git a/x-pack/plugins/osquery/public/agents/helpers.ts b/x-pack/plugins/osquery/public/agents/helpers.ts
index fef17aadb62be..830fca5f57caa 100644
--- a/x-pack/plugins/osquery/public/agents/helpers.ts
+++ b/x-pack/plugins/osquery/public/agents/helpers.ts
@@ -5,15 +5,97 @@
* 2.0.
*/
+import { Aggregate, TermsAggregate } from '@elastic/elasticsearch/api/types';
+import { euiPaletteColorBlindBehindText } from '@elastic/eui';
import {
PaginationInputPaginated,
FactoryQueryTypes,
StrategyResponseType,
Inspect,
} from '../../common/search_strategy';
+import {
+ AGENT_GROUP_KEY,
+ SelectedGroups,
+ Overlap,
+ Group,
+ AgentOptionValue,
+ AggregationDataPoint,
+} from './types';
export type InspectResponse = Inspect & { response: string[] };
+export const getNumOverlapped = (
+ { policy = {}, platform = {} }: SelectedGroups,
+ overlap: Overlap
+) => {
+ let sum = 0;
+ Object.keys(platform).forEach((plat) => {
+ const policies = overlap[plat] ?? {};
+ Object.keys(policy).forEach((pol) => {
+ sum += policies[pol] ?? 0;
+ });
+ });
+ return sum;
+};
+export const processAggregations = (aggs: Record) => {
+ const platforms: Group[] = [];
+ const overlap: Overlap = {};
+ const platformTerms = aggs.platforms as TermsAggregate;
+ const policyTerms = aggs.policies as TermsAggregate;
+
+ const policies = policyTerms?.buckets.map((o) => ({ name: o.key, size: o.doc_count })) ?? [];
+
+ if (platformTerms?.buckets) {
+ for (const { key, doc_count: size, policies: platformPolicies } of platformTerms.buckets) {
+ platforms.push({ name: key, size });
+ if (platformPolicies?.buckets && policies.length > 0) {
+ overlap[key] = platformPolicies.buckets.reduce((acc: { [key: string]: number }, pol) => {
+ acc[pol.key] = pol.doc_count;
+ return acc;
+ }, {} as { [key: string]: number });
+ }
+ }
+ }
+
+ return {
+ platforms,
+ overlap,
+ policies,
+ };
+};
+export const generateColorPicker = () => {
+ const visColorsBehindText = euiPaletteColorBlindBehindText();
+ const typeColors = new Map();
+ return (type: AGENT_GROUP_KEY) => {
+ if (!typeColors.has(type)) {
+ typeColors.set(type, visColorsBehindText[typeColors.size]);
+ }
+ return typeColors.get(type);
+ };
+};
+
+export const getNumAgentsInGrouping = (selectedGroups: SelectedGroups) => {
+ let sum = 0;
+ Object.keys(selectedGroups).forEach((g) => {
+ const group = selectedGroups[g];
+ sum += Object.keys(group).reduce((acc, k) => acc + group[k], 0);
+ });
+ return sum;
+};
+
+export const generateAgentCheck = (selectedGroups: SelectedGroups) => {
+ return ({ groups }: AgentOptionValue) => {
+ return Object.keys(groups)
+ .map((group) => {
+ const selectedGroup = selectedGroups[group];
+ const agentGroup = groups[group];
+ // check if the agent platform/policy is selected
+ return selectedGroup[agentGroup];
+ })
+ .every((a) => !a);
+ };
+};
+
export const generateTablePaginationOptions = (
activePage: number,
limit: number,
diff --git a/x-pack/plugins/osquery/public/agents/translations.ts b/x-pack/plugins/osquery/public/agents/translations.ts
index 0d9d9a8a12b8f..af99a73d63de2 100644
--- a/x-pack/plugins/osquery/public/agents/translations.ts
+++ b/x-pack/plugins/osquery/public/agents/translations.ts
@@ -7,6 +7,42 @@
import { i18n } from '@kbn/i18n';
+export const generateSelectedAgentsMessage = (numAgents: number): string => {
+ if (numAgents === 0) {
+ return '';
+ } else if (numAgents === 1) {
+ return i18n.translate('xpack.osquery.agents.oneSelectedAgentText', {
+ defaultMessage: '{numAgents} agent selected.',
+ values: { numAgents },
+ });
+ } else {
+ return i18n.translate('xpack.osquery.agents.mulitpleSelectedAgentsText', {
+ defaultMessage: '{numAgents} agents selected.',
+ values: { numAgents },
+ });
+ }
+};
+
+export const ALL_AGENTS_LABEL = i18n.translate('xpack.osquery.agents.allAgentsLabel', {
+ defaultMessage: `All agents`,
+});
+
+export const AGENT_PLATFORMS_LABEL = i18n.translate('xpack.osquery.agents.platformLabel', {
+ defaultMessage: `Platform`,
+});
+
+export const AGENT_POLICY_LABEL = i18n.translate('xpack.osquery.agents.policyLabel', {
+ defaultMessage: `Policy`,
+});
+
+export const AGENT_SELECTION_LABEL = i18n.translate('xpack.osquery.agents.selectionLabel', {
+ defaultMessage: `Agents`,
+});
+
+export const SELECT_AGENT_LABEL = i18n.translate('xpack.osquery.agents.selectAgentLabel', {
+ defaultMessage: `Select Agents`,
+});
+
export const ERROR_ALL_AGENTS = i18n.translate('xpack.osquery.agents.errorSearchDescription', {
defaultMessage: `An error has occurred on all agents search`,
});
diff --git a/x-pack/plugins/osquery/public/agents/types.ts b/x-pack/plugins/osquery/public/agents/types.ts
new file mode 100644
index 0000000000000..2fa8ddaf345cd
--- /dev/null
+++ b/x-pack/plugins/osquery/public/agents/types.ts
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { TermsAggregate } from '@elastic/elasticsearch/api/types';
+
+interface BaseDataPoint {
+ key: string;
+ doc_count: number;
+}
+
+export type AggregationDataPoint = BaseDataPoint & {
+ [key: string]: TermsAggregate;
+};
+
+export interface Group {
+ name: string;
+ size: number;
+}
+export interface Overlap {
+ [platform: string]: { [policy: string]: number };
+}
+
+export interface SelectedGroups {
+ [groupType: string]: { [groupName: string]: number };
+}
+
+interface BaseGroupOption {
+ groupType: AGENT_GROUP_KEY;
+}
+
+export type AgentOptionValue = BaseGroupOption & {
+ groups: { [groupType: string]: string };
+ online: boolean;
+ id: string;
+};
+
+export type GroupOptionValue = BaseGroupOption & {
+ size: number;
+};
+
+export enum AGENT_GROUP_KEY {
+ All,
+ Platform,
+ Policy,
+ Agent,
+}
diff --git a/x-pack/plugins/osquery/public/agents/use_agent_groups.ts b/x-pack/plugins/osquery/public/agents/use_agent_groups.ts
new file mode 100644
index 0000000000000..0eaca65d02d4b
--- /dev/null
+++ b/x-pack/plugins/osquery/public/agents/use_agent_groups.ts
@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { useState } from 'react';
+import { useQuery } from 'react-query';
+import { useKibana } from '../common/lib/kibana';
+
+import {
+ OsqueryQueries,
+ AgentsRequestOptions,
+ AgentsStrategyResponse,
+} from '../../common/search_strategy';
+
+import { generateTablePaginationOptions, processAggregations } from './helpers';
+import { Overlap, Group } from './types';
+
+interface UseAgentGroups {
+ osqueryPolicies: string[];
+ osqueryPoliciesLoading: boolean;
+}
+
+export const useAgentGroups = ({ osqueryPolicies, osqueryPoliciesLoading }: UseAgentGroups) => {
+ const { data } = useKibana().services;
+
+ const [platforms, setPlatforms] = useState([]);
+ const [policies, setPolicies] = useState([]);
+ const [loading, setLoading] = useState(true);
+ const [overlap, setOverlap] = useState(() => ({}));
+ const [totalCount, setTotalCount] = useState(0);
+ useQuery(
+ ['agentGroups'],
+ async () => {
+ const responseData = await data.search
+ .search(
+ {
+ filterQuery: { terms: { policy_id: osqueryPolicies } },
+ factoryQueryType: OsqueryQueries.agents,
+ aggregations: {
+ platforms: {
+ terms: {
+ field: 'local_metadata.os.platform',
+ },
+ aggs: {
+ policies: {
+ terms: {
+ field: 'policy_id',
+ },
+ },
+ },
+ },
+ policies: {
+ terms: {
+ field: 'policy_id',
+ },
+ },
+ },
+ pagination: generateTablePaginationOptions(0, 9000),
+ sort: {
+ direction: 'asc',
+ field: 'local_metadata.os.platform',
+ },
+ } as AgentsRequestOptions,
+ {
+ strategy: 'osquerySearchStrategy',
+ }
+ )
+ .toPromise();
+
+ if (responseData.rawResponse.aggregations) {
+ const {
+ platforms: newPlatforms,
+ overlap: newOverlap,
+ policies: newPolicies,
+ } = processAggregations(responseData.rawResponse.aggregations);
+
+ setPlatforms(newPlatforms);
+ setOverlap(newOverlap);
+ setPolicies(newPolicies);
+ }
+
+ setLoading(false);
+ setTotalCount(responseData.totalCount);
+ },
+ {
+ enabled: !osqueryPoliciesLoading,
+ }
+ );
+
+ return {
+ loading,
+ totalCount,
+ groups: {
+ platforms,
+ policies,
+ overlap,
+ },
+ };
+};
diff --git a/x-pack/plugins/osquery/public/agents/use_all_agents.ts b/x-pack/plugins/osquery/public/agents/use_all_agents.ts
index 663c6936fe55b..607f9ae007692 100644
--- a/x-pack/plugins/osquery/public/agents/use_all_agents.ts
+++ b/x-pack/plugins/osquery/public/agents/use_all_agents.ts
@@ -5,94 +5,32 @@
* 2.0.
*/
-import deepEqual from 'fast-deep-equal';
-import { useEffect, useState } from 'react';
import { useQuery } from 'react-query';
-import { createFilter } from '../common/helpers';
import { useKibana } from '../common/lib/kibana';
-import {
- PageInfoPaginated,
- OsqueryQueries,
- AgentsRequestOptions,
- AgentsStrategyResponse,
- Direction,
-} from '../../common/search_strategy';
-import { ESTermQuery } from '../../common/typed_json';
-import { Agent } from '../../common/shared_imports';
-
-import { generateTablePaginationOptions, getInspectResponse, InspectResponse } from './helpers';
-
-export interface AgentsArgs {
- agents: Agent[];
- id: string;
- inspect: InspectResponse;
- isInspected: boolean;
- pageInfo: PageInfoPaginated;
- totalCount: number;
-}
interface UseAllAgents {
- activePage: number;
- direction: Direction;
- limit: number;
- sortField: string;
- filterQuery?: ESTermQuery | string;
- skip?: boolean;
+ osqueryPolicies: string[];
+ osqueryPoliciesLoading: boolean;
}
-export const useAllAgents = ({
- activePage,
- direction,
- limit,
- sortField,
- filterQuery,
- skip = false,
-}: UseAllAgents) => {
- const { data } = useKibana().services;
-
- const [agentsRequest, setHostRequest] = useState(null);
-
- const response = useQuery(
- ['agents', { activePage, direction, limit, sortField }],
+export const useAllAgents = ({ osqueryPolicies, osqueryPoliciesLoading }: UseAllAgents) => {
+ // TODO: properly fetch these in an async manner
+ const { http } = useKibana().services;
+ const { isLoading: agentsLoading, data: agentData } = useQuery(
+ ['agents', osqueryPolicies],
async () => {
- if (!agentsRequest) return Promise.resolve();
-
- const responseData = await data.search
- .search(agentsRequest, {
- strategy: 'osquerySearchStrategy',
- })
- .toPromise();
-
- return {
- ...responseData,
- agents: responseData.edges,
- inspect: getInspectResponse(responseData),
- };
+ return await http.get('/api/fleet/agents', {
+ query: {
+ kuery: osqueryPolicies.map((p) => `policy_id:${p}`).join(' or '),
+ perPage: 9000,
+ },
+ });
},
{
- enabled: !skip && !!agentsRequest,
+ enabled: !osqueryPoliciesLoading,
}
);
- useEffect(() => {
- setHostRequest((prevRequest) => {
- const myRequest = {
- ...(prevRequest ?? {}),
- factoryQueryType: OsqueryQueries.agents,
- filterQuery: createFilter(filterQuery),
- pagination: generateTablePaginationOptions(activePage, limit),
- sort: {
- direction,
- field: sortField,
- },
- };
- if (!deepEqual(prevRequest, myRequest)) {
- return myRequest;
- }
- return prevRequest;
- });
- }, [activePage, direction, filterQuery, limit, sortField]);
-
- return response;
+ return { agentsLoading, agents: agentData?.list };
};
diff --git a/x-pack/plugins/osquery/public/agents/use_osquery_policies.ts b/x-pack/plugins/osquery/public/agents/use_osquery_policies.ts
new file mode 100644
index 0000000000000..f786e9167d2f8
--- /dev/null
+++ b/x-pack/plugins/osquery/public/agents/use_osquery_policies.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useQuery } from 'react-query';
+import { useKibana } from '../common/lib/kibana';
+import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '../../../fleet/common';
+
+export const useOsqueryPolicies = () => {
+ const { http } = useKibana().services;
+
+ const { isLoading: osqueryPoliciesLoading, data: osqueryPolicies } = useQuery(
+ ['osqueryPolicies'],
+ async () => {
+ return await http.get('/api/fleet/package_policies', {
+ query: {
+ kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name:osquery_manager`,
+ },
+ });
+ },
+ { select: (data) => data.items.map((p: { policy_id: string }) => p.policy_id) }
+ );
+
+ return { osqueryPoliciesLoading, osqueryPolicies };
+};
diff --git a/x-pack/plugins/osquery/public/live_query/form/agents_table_field.tsx b/x-pack/plugins/osquery/public/live_query/form/agents_table_field.tsx
index 7a93b5d2491db..4bc9262af7613 100644
--- a/x-pack/plugins/osquery/public/live_query/form/agents_table_field.tsx
+++ b/x-pack/plugins/osquery/public/live_query/form/agents_table_field.tsx
@@ -7,10 +7,10 @@
import React, { useCallback } from 'react';
import { FieldHook } from '../../shared_imports';
-import { AgentsTable } from '../../agents/agents_table';
+import { AgentsTable, AgentsSelection } from '../../agents/agents_table';
interface AgentsTableFieldProps {
- field: FieldHook;
+ field: FieldHook;
}
const AgentsTableFieldComponent: React.FC = ({ field }) => {
@@ -24,7 +24,7 @@ const AgentsTableFieldComponent: React.FC = ({ field }) =
[value, setValue]
);
- return ;
+ return ;
};
export const AgentsTableField = React.memo(AgentsTableFieldComponent);
diff --git a/x-pack/plugins/osquery/public/live_query/form/index.tsx b/x-pack/plugins/osquery/public/live_query/form/index.tsx
index 4a69e2fc0e76d..7e19bee530ec5 100644
--- a/x-pack/plugins/osquery/public/live_query/form/index.tsx
+++ b/x-pack/plugins/osquery/public/live_query/form/index.tsx
@@ -40,7 +40,7 @@ const LiveQueryFormComponent: React.FC = ({ defaultValue, on
return (