Skip to content

Commit

Permalink
updated hooks used
Browse files Browse the repository at this point in the history
  • Loading branch information
@animehart
animehart committed Nov 8, 2024
1 parent 25e54ba commit d49d5ab
Show file tree
Hide file tree
Showing 4 changed files with 109 additions and 41 deletions.
40 changes: 40 additions & 0 deletions x-pack/packages/kbn-cloud-security-posture/common/utils/helpers.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -62,3 +62,43 @@ export const buildEntityFlyoutPreviewQuery = (field: string, queryValue?: string
},
};
};

export const buildEntityAlertsQuery = (field: string, queryValue?: string, size?: number) => {
return {
size: size || 0,
_source: false,
fields: [
'kibana.alert.rule.uuid',
'signal.rule.name',
'signal.rule.severity',
'kibana.alert.reason',
],
query: {
bool: {
filter: [
{
bool: {
must: [],
filter: [
{
match_phrase: {
[field]: {
query: queryValue,
},
},
},
],
should: [],
must_not: [],
},
},
{
terms: {
'kibana.alert.workflow_status': ['open', 'acknowledged'],
},
},
],
},
},
};
};
39 changes: 35 additions & 4 deletions ...security_solution/public/cloud_security_posture/components/alerts/alerts_preview.test.tsx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,42 @@ import { render } from '@testing-library/react';
import { AlertsPreview } from './alerts_preview';
import { TestProviders } from '../../../common/mock/test_providers';
import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
import type { ParsedAlertsData } from '../../../overview/components/detection_response/alerts_by_status/types';
import type { AlertSearchResponse } from '../../../detections/containers/detection_engine/alerts/types';

const mockAlertsData: ParsedAlertsData = {
closed: { total: 1, severities: [{ key: 'low', value: 1, label: 'Low' }] },
open: { total: 1, severities: [{ key: 'low', value: 1, label: 'Low' }] },
const mockAlertsData: AlertSearchResponse<unknown, unknown> = {
took: 0,
timeout: false,
_shards: {
total: 1,
successful: 1,
skipped: 0,
failed: 0,
},
hits: {
total: {
value: 2,
relation: 'eq',
},
max_score: 0,
hits: [
{
fields: {
'signal.rule.name': ['Low Alert'],
'kibana.alert.reason': ['Low Alert Reason'],
'kibana.alert.rule.uuid': ['Low Alert UUID'],
'signal.rule.severity': ['low'],
},
},
{
fields: {
'signal.rule.name': ['Medium Alert'],
'kibana.alert.reason': ['Medium Alert Reason'],
'kibana.alert.rule.uuid': ['Medium Alert UUID'],
'signal.rule.severity': ['medium'],
},
},
],
},
};

jest.mock(
Expand Down
42 changes: 25 additions & 17 deletions ...gins/security_solution/public/cloud_security_posture/components/alerts/alerts_preview.tsx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,20 @@ import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiText, EuiTitle, useEuiTheme }
import { FormattedMessage } from '@kbn/i18n-react';
import { DistributionBar } from '@kbn/security-solution-distribution-bar';
import { getAbbreviatedNumber } from '@kbn/cloud-security-posture-common';
import type { AlertSearchResponse } from '../../../detections/containers/detection_engine/alerts/types';
import { ExpandablePanel } from '../../../flyout/shared/components/expandable_panel';
import { getSeverityColor } from '../../../detections/components/alerts_kpis/severity_level_panel/helpers';
import type {
AlertsByStatus,
ParsedAlertsData,
} from '../../../overview/components/detection_response/alerts_by_status/types';

interface CspAlertsField {
'kibana.alert.rule.uuid': string[];
'kibana.alert.reason': string[];
'signal.rule.name': string[];
'signal.rule.severity': string[];
}

interface AlertsDetailsFields {
fields: CspAlertsField;
}

const AlertsCount = ({
alertsTotal,
Expand Down Expand Up @@ -57,25 +65,25 @@ export const AlertsPreview = ({
alertsCount,
isPreviewMode,
}: {
alertsData: ParsedAlertsData;
alertsData: AlertSearchResponse<unknown, unknown> | null;
alertsCount: number;
isPreviewMode?: boolean;
}) => {
const { euiTheme } = useEuiTheme();

const severityMap = new Map<string, number>();

(['open', 'acknowledged'] as AlertsByStatus[]).forEach((status) => {
alertsData?.[status]?.severities.forEach((severity) => {
if (severityMap.has(severity.key)) {
severityMap.set(severity.key, (severityMap?.get(severity.key) || 0) + severity.value);
} else {
severityMap.set(severity.key, severity.value);
}
});
});
const resultX = (alertsData?.hits?.hits as AlertsDetailsFields[])?.map(
(item: AlertsDetailsFields) => {
return { fields: item.fields };
}
);

const alertStats = Array.from(severityMap, ([key, count]) => ({
const severities = resultX?.map((item) => item.fields['signal.rule.severity'][0]) || [];
const alertStats = Object.entries(
severities.reduce((acc: Record<string, number>, item) => {
acc[item] = (acc[item] || 0) + 1;
return acc;
}, {})
).map(([key, count]) => ({
key,
count,
color: getSeverityColor(key),
Expand Down
29 changes: 9 additions & 20 deletions x-pack/plugins/security_solution/public/cloud_security_posture/components/entity_insight.tsx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,20 +7,20 @@

import { EuiAccordion, EuiHorizontalRule, EuiSpacer, EuiTitle, useEuiTheme } from '@elastic/eui';

import React, { useMemo } from 'react';
import React from 'react';
import { css } from '@emotion/react';
import { FormattedMessage } from '@kbn/i18n-react';
import { useMisconfigurationPreview } from '@kbn/cloud-security-posture/src/hooks/use_misconfiguration_preview';
import { buildEntityFlyoutPreviewQuery } from '@kbn/cloud-security-posture-common';
import { useVulnerabilitiesPreview } from '@kbn/cloud-security-posture/src/hooks/use_vulnerabilities_preview';
import { hasVulnerabilitiesData } from '@kbn/cloud-security-posture';
import { buildEntityAlertsQuery } from '@kbn/cloud-security-posture-common/utils/helpers';
import { MisconfigurationsPreview } from './misconfiguration/misconfiguration_preview';
import { VulnerabilitiesPreview } from './vulnerabilities/vulnerabilities_preview';
import { AlertsPreview } from './alerts/alerts_preview';
import { useGlobalTime } from '../../common/containers/use_global_time';
import { DETECTION_RESPONSE_ALERTS_BY_STATUS_ID } from '../../overview/components/detection_response/alerts_by_status/types';
import { useAlertsByStatus } from '../../overview/components/detection_response/alerts_by_status/use_alerts_by_status';
import { useSignalIndex } from '../../detections/containers/detection_engine/alerts/use_signal_index';
import { ALERTS_QUERY_NAMES } from '../../detections/containers/detection_engine/alerts/constants';
import { useQueryAlerts } from '../../detections/containers/detection_engine/alerts/use_query';

export const EntityInsight = <T,>({
name,
Expand Down Expand Up @@ -67,24 +67,13 @@ export const EntityInsight = <T,>({

const { signalIndexName } = useSignalIndex();

const entityFilter = useMemo(() => ({ field: fieldName, value: name }), [fieldName, name]);

const { to, from } = useGlobalTime();

const { items: alertsData } = useAlertsByStatus({
entityFilter,
signalIndexName,
queryId: DETECTION_RESPONSE_ALERTS_BY_STATUS_ID,
to,
from,
const { data: alertsData } = useQueryAlerts({
query: buildEntityAlertsQuery(fieldName, name, 500),
queryName: ALERTS_QUERY_NAMES.ALERTS_COUNT_BY_STATUS,
indexName: signalIndexName,
});

const alertsOpenCount = alertsData?.open?.total || 0;

const alertsAcknowledgedCount = alertsData?.acknowledged?.total || 0;

const alertsCount = alertsOpenCount + alertsAcknowledgedCount;

const alertsCount = alertsData?.hits?.total.value || 0;
if (alertsCount > 0) {
insightContent.push(
<>
Expand Down

0 comments on commit d49d5ab

Please sign in to comment.