[Security Solution] Refactor NetworkTopNFlow to use Search Strategy

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -21,6 +21,8 @@ import {
   NetworkHttpRequestOptions,
   NetworkTopCountriesStrategyResponse,
   NetworkTopCountriesRequestOptions,
+  NetworkTopNFlowStrategyResponse,
+  NetworkTopNFlowRequestOptions,
 } from './network';
 
 export * from './hosts';
@@ -117,6 +119,8 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   ? NetworkHttpStrategyResponse
   : T extends NetworkQueries.topCountries
   ? NetworkTopCountriesStrategyResponse
+  : T extends NetworkQueries.topNFlow
+  ? NetworkTopNFlowStrategyResponse
   : never;
 
 export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
@@ -129,9 +133,16 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   ? NetworkHttpRequestOptions
   : T extends NetworkQueries.topCountries
   ? NetworkTopCountriesRequestOptions
+  : T extends NetworkQueries.topNFlow
+  ? NetworkTopNFlowRequestOptions
   : never;
 
 export interface GenericBuckets {
   key: string;
   doc_count: number;
 }
+
+export interface TotalValue {
+  value: number;
+  relation: string;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/common.ts

@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { GeoEcs } from '../../../ecs/geo';
+import { Maybe } from '..';
+
+export enum NetworkTopTablesFields {
+  bytes_in = 'bytes_in',
+  bytes_out = 'bytes_out',
+  flows = 'flows',
+  destination_ips = 'destination_ips',
+  source_ips = 'source_ips',
+}
+
+export interface NetworkTopTablesSortField {
+  field: NetworkTopTablesFields;
+  direction: Direction;
+}
+
+export enum FlowTargetSourceDest {
+  destination = 'destination',
+  source = 'source',
+}
+
+export enum Direction {
+  asc = 'asc',
+  desc = 'desc',
+}
+
+export interface GeoItem {
+  geo?: Maybe<GeoEcs>;
+  flowTarget?: Maybe<FlowTargetSourceDest>;
+}
+
+export interface TopNetworkTablesEcsField {
+  bytes_in?: Maybe<number>;
+  bytes_out?: Maybe<number>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/http.ts

@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../src/plugins/data/common';
+import { Direction } from './common';
+import {
+  CursorType,
+  GenericBuckets,
+  Inspect,
+  Maybe,
+  PageInfoPaginated,
+  RequestOptionsPaginated,
+} from '..';
+
+export interface NetworkHttpRequestOptions extends RequestOptionsPaginated {
+  ip?: string;
+  networkHttpSort: NetworkHttpSortField;
+  defaultIndex: string[];
+}
+
+export interface NetworkHttpStrategyResponse extends IEsSearchResponse {
+  edges: NetworkHttpEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface NetworkHttpSortField {
+  direction: Direction;
+}
+
+export interface NetworkHttpData {
+  edges: NetworkHttpEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface NetworkHttpEdges {
+  node: NetworkHttpItem;
+  cursor: CursorType;
+}
+
+export interface NetworkHttpItem {
+  _id?: Maybe<string>;
+  domains: string[];
+  lastHost?: Maybe<string>;
+  lastSourceIp?: Maybe<string>;
+  methods: string[];
+  path?: Maybe<string>;
+  requestCount?: Maybe<number>;
+  statuses: string[];
+}
+
+export interface NetworkHttpBuckets {
+  key: string;
+  doc_count: number;
+  domains: {
+    buckets: GenericBuckets[];
+  };
+  methods: {
+    buckets: GenericBuckets[];
+  };
+  source: object;
+  status: {
+    buckets: GenericBuckets[];
+  };
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts

@@ -5,29 +5,19 @@
  */
 
 import { IEsSearchResponse } from '../../../../../../../src/plugins/data/common';
-import { GeoEcs } from '../../../ecs/geo';
 
-import {
-  CursorType,
-  Inspect,
-  Maybe,
-  PageInfoPaginated,
-  RequestOptionsPaginated,
-  GenericBuckets,
-} from '..';
+import { CursorType, Inspect, Maybe, PageInfoPaginated, RequestOptionsPaginated } from '..';
+
+export * from './common';
+export * from './http';
+export * from './top_countries';
+export * from './top_n_flow';
 
 export enum NetworkQueries {
   http = 'http',
   tls = 'tls',
   topCountries = 'topCountries',
-}
-
-export enum NetworkTopTablesFields {
-  bytes_in = 'bytes_in',
-  bytes_out = 'bytes_out',
-  flows = 'flows',
-  destination_ips = 'destination_ips',
-  source_ips = 'source_ips',
+  topNFlow = 'topNFlow',
 }
 
 export enum NetworkDnsFields {
@@ -109,10 +99,6 @@ export interface TlsSortField {
   direction: Direction;
 }
 
-export interface NetworkHttpSortField {
-  direction: Direction;
-}
-
 export interface NetworkTlsRequestOptions extends RequestOptionsPaginated {
   ip: string;
   flowTarget: FlowTargetSourceDest;
@@ -129,156 +115,3 @@ export interface NetworkTlsStrategyResponse extends IEsSearchResponse {
 
   inspect?: Maybe<Inspect>;
 }
-
-export interface NetworkHttpRequestOptions extends RequestOptionsPaginated {
-  ip?: string;
-  networkHttpSort: NetworkHttpSortField;
-  defaultIndex: string[];
-}
-
-export interface NetworkHttpStrategyResponse extends IEsSearchResponse {
-  edges: NetworkHttpEdges[];
-
-  totalCount: number;
-
-  pageInfo: PageInfoPaginated;
-
-  inspect?: Maybe<Inspect>;
-}
-
-export interface GeoItem {
-  geo?: Maybe<GeoEcs>;
-
-  flowTarget?: Maybe<FlowTargetSourceDest>;
-}
-
-export interface TopCountriesItemSource {
-  country?: Maybe<string>;
-
-  destination_ips?: Maybe<number>;
-
-  flows?: Maybe<number>;
-
-  location?: Maybe<GeoItem>;
-
-  source_ips?: Maybe<number>;
-}
-
-export interface NetworkTopCountriesRequestOptions extends RequestOptionsPaginated {
-  networkTopCountriesSort: NetworkTopTablesSortField;
-  flowTarget: FlowTargetSourceDest;
-  ip?: string;
-}
-
-export interface NetworkTopCountriesStrategyResponse extends IEsSearchResponse {
-  edges: NetworkTopCountriesEdges[];
-
-  totalCount: number;
-
-  pageInfo: PageInfoPaginated;
-
-  inspect?: Maybe<Inspect>;
-}
-
-export interface NetworkTopCountriesEdges {
-  node: NetworkTopCountriesItem;
-
-  cursor: CursorType;
-}
-
-export interface NetworkTopCountriesItem {
-  _id?: Maybe<string>;
-
-  source?: Maybe<TopCountriesItemSource>;
-
-  destination?: Maybe<TopCountriesItemDestination>;
-
-  network?: Maybe<TopNetworkTablesEcsField>;
-}
-
-export interface TopCountriesItemDestination {
-  country?: Maybe<string>;
-
-  destination_ips?: Maybe<number>;
-
-  flows?: Maybe<number>;
-
-  location?: Maybe<GeoItem>;
-
-  source_ips?: Maybe<number>;
-}
-
-export interface TopNetworkTablesEcsField {
-  bytes_in?: Maybe<number>;
-
-  bytes_out?: Maybe<number>;
-}
-
-export interface NetworkTopTablesSortField {
-  field: NetworkTopTablesFields;
-
-  direction: Direction;
-}
-
-export interface NetworkTopCountriesBuckets {
-  country: string;
-  key: string;
-  bytes_in: {
-    value: number;
-  };
-  bytes_out: {
-    value: number;
-  };
-  flows: number;
-  destination_ips: number;
-  source_ips: number;
-}
-
-export interface NetworkHttpData {
-  edges: NetworkHttpEdges[];
-
-  totalCount: number;
-
-  pageInfo: PageInfoPaginated;
-
-  inspect?: Maybe<Inspect>;
-}
-
-export interface NetworkHttpEdges {
-  node: NetworkHttpItem;
-
-  cursor: CursorType;
-}
-
-export interface NetworkHttpItem {
-  _id?: Maybe<string>;
-
-  domains: string[];
-
-  lastHost?: Maybe<string>;
-
-  lastSourceIp?: Maybe<string>;
-
-  methods: string[];
-
-  path?: Maybe<string>;
-
-  requestCount?: Maybe<number>;
-
-  statuses: string[];
-}
-
-export interface NetworkHttpBuckets {
-  key: string;
-  doc_count: number;
-  domains: {
-    buckets: GenericBuckets[];
-  };
-  methods: {
-    buckets: GenericBuckets[];
-  };
-  source: object;
-  status: {
-    buckets: GenericBuckets[];
-  };
-}