[Security Solution][RAC] - Add reason field

x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts

@@ -54,7 +54,7 @@ describe('Alert details with unmapped fields', () => {
 
   it('Displays the unmapped field on the table', () => {
     const expectedUnmmappedField = {
-      row: 88,
+      row: 90,
       field: 'unmapped',
       text: 'This is the unmapped field',
     };

x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signal_aad_mapping.json

@@ -17,6 +17,7 @@
   "signal.original_event.module": "kibana.alert.original_event.module",
   "signal.original_event.outcome": "kibana.alert.original_event.outcome",
   "signal.original_event.provider": "kibana.alert.original_event.provider",
+  "signal.original_event.reason": "kibana.alert.original_event.reason",
   "signal.original_event.risk_score": "kibana.alert.original_event.risk_score",
   "signal.original_event.risk_score_norm": "kibana.alert.original_event.risk_score_norm",
   "signal.original_event.sequence": "kibana.alert.original_event.sequence",
@@ -25,6 +26,7 @@
   "signal.original_event.timezone": "kibana.alert.original_event.timezone",
   "signal.original_event.type": "kibana.alert.original_event.type",
   "signal.original_time": "kibana.alert.original_time",
+  "signal.reason": "kibana.alert.reason",
   "signal.rule.author": "kibana.alert.rule.author",
   "signal.rule.building_block_type": "kibana.alert.rule.building_block_type",
   "signal.rule.created_at": "kibana.alert.rule.created_at",

x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signal_extra_fields.json

@@ -43,6 +43,9 @@
           }
         }
       },
+      "reason": {
+        "type": "keyword"
+      },
       "rule": {
         "type": "object",
         "properties": {

x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signals_mapping.json

@@ -360,6 +360,9 @@
               "provider": {
                 "type": "keyword"
               },
+              "reason": {
+                "type": "keyword"
+              },
               "risk_score": {
                 "type": "float"
               },
@@ -421,6 +424,9 @@
           },
           "depth": {
             "type": "integer"
+          },
+          "reason": {
+            "type": "keyword"
           }
         }
       }

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts

@@ -7,6 +7,7 @@
 
 import {
   ALERT_OWNER,
+  ALERT_REASON,
   ALERT_RULE_NAMESPACE,
   ALERT_STATUS,
   ALERT_WORKFLOW_STATUS,
@@ -50,8 +51,9 @@ describe('buildAlert', () => {
     const doc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
     delete doc._source.event;
     const rule = getRulesSchemaMock();
+    const reason = 'alert reasonable reason';
     const alert = {
-      ...buildAlert([doc], rule, SPACE_ID),
+      ...buildAlert([doc], rule, SPACE_ID, reason),
       ...additionalAlertFields(doc),
     };
     const timestamp = alert['@timestamp'];
@@ -68,6 +70,7 @@ describe('buildAlert', () => {
         },
       ],
       [ALERT_ORIGINAL_TIME]: '2020-04-20T21:27:45.000Z',
+      [ALERT_REASON]: 'alert reasonable reason',
       [ALERT_STATUS]: 'open',
       [ALERT_WORKFLOW_STATUS]: 'open',
       ...flattenWithPrefix(ALERT_RULE_NAMESPACE, {
@@ -119,8 +122,9 @@ describe('buildAlert', () => {
       module: 'system',
     };
     const rule = getRulesSchemaMock();
+    const reason = 'alert reasonable reason';
     const alert = {
-      ...buildAlert([doc], rule, SPACE_ID),
+      ...buildAlert([doc], rule, SPACE_ID, reason),
       ...additionalAlertFields(doc),
     };
     const timestamp = alert['@timestamp'];
@@ -143,6 +147,7 @@ describe('buildAlert', () => {
         kind: 'event',
         module: 'system',
       },
+      [ALERT_REASON]: 'alert reasonable reason',
       [ALERT_STATUS]: 'open',
       [ALERT_WORKFLOW_STATUS]: 'open',
       ...flattenWithPrefix(ALERT_RULE_NAMESPACE, {

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.ts

@@ -7,6 +7,7 @@
 
 import {
   ALERT_OWNER,
+  ALERT_REASON,
   ALERT_RULE_NAMESPACE,
   ALERT_STATUS,
   ALERT_WORKFLOW_STATUS,
@@ -92,7 +93,8 @@ export const removeClashes = (doc: SimpleHit) => {
 export const buildAlert = (
   docs: SimpleHit[],
   rule: RulesSchema,
-  spaceId: string | null | undefined
+  spaceId: string | null | undefined,
+  reason: string
 ): RACAlert => {
   const removedClashes = docs.map(removeClashes);
   const parents = removedClashes.map(buildParent);
@@ -110,6 +112,7 @@ export const buildAlert = (
     [ALERT_STATUS]: 'open',
     [ALERT_WORKFLOW_STATUS]: 'open',
     [ALERT_DEPTH]: depth,
+    [ALERT_REASON]: reason,
     ...flattenWithPrefix(ALERT_RULE_NAMESPACE, rule),
   } as unknown) as RACAlert;
 };

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_bulk_body.ts

@@ -9,6 +9,7 @@ import { SavedObject } from 'src/core/types';
 import { BaseHit } from '../../../../../../common/detection_engine/types';
 import type { ConfigType } from '../../../../../config';
 import { buildRuleWithOverrides, buildRuleWithoutOverrides } from '../../../signals/build_rule';
+import { BuildReasonMessage } from '../../../signals/reason_formatters';
 import { getMergeStrategy } from '../../../signals/source_fields_merging/strategies';
 import { AlertAttributes, SignalSource, SignalSourceHit } from '../../../signals/types';
 import { RACAlert } from '../../types';
@@ -35,19 +36,35 @@ export const buildBulkBody = (
   ruleSO: SavedObject<AlertAttributes>,
   doc: SignalSourceHit,
   mergeStrategy: ConfigType['alertMergeStrategy'],
-  applyOverrides: boolean
+  applyOverrides: boolean,
+  buildReasonMessage: BuildReasonMessage
 ): RACAlert => {
   const mergedDoc = getMergeStrategy(mergeStrategy)({ doc });
   const rule = applyOverrides
     ? buildRuleWithOverrides(ruleSO, mergedDoc._source ?? {})
     : buildRuleWithoutOverrides(ruleSO);
   const filteredSource = filterSource(mergedDoc);
+  const timestamp = new Date().toISOString();
+  let hostName = '';
+  let userName = '';
+  if (mergedDoc.fields) {
+    hostName = mergedDoc.fields['host.name'] != null ? mergedDoc.fields['host.name'] : hostName;
+    userName = mergedDoc.fields['user.name'] != null ? mergedDoc.fields['user.name'] : userName;
+  }
+  const reason = buildReasonMessage({
+    alertName: rule.name,
+    alertRiskScore: ruleSO.attributes.params.riskScore,
+    alertSeverity: ruleSO.attributes.params.severity,
+    hostName,
+    timestamp,
+    userName,
+  });
   if (isSourceDoc(mergedDoc)) {
     return {
       ...filteredSource,
-      ...buildAlert([mergedDoc], rule, spaceId),
+      ...buildAlert([mergedDoc], rule, spaceId, reason),
       ...additionalAlertFields(mergedDoc),
-      '@timestamp': new Date().toISOString(),
+      '@timestamp': timestamp,
     };
   }
 

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/wrap_hits_factory.ts

@@ -24,7 +24,7 @@ export const wrapHitsFactory = ({
   ruleSO: SearchAfterAndBulkCreateParams['ruleSO'];
   mergeStrategy: ConfigType['alertMergeStrategy'];
   spaceId: string | null | undefined;
-}): WrapHits => (events) => {
+}): WrapHits => (events, buildReasonMessage) => {
   try {
     const wrappedDocs: WrappedRACAlert[] = events.flatMap((doc) => [
       {
@@ -35,7 +35,14 @@ export const wrapHitsFactory = ({
           String(doc._version),
           ruleSO.attributes.params.ruleId ?? ''
         ),
-        _source: buildBulkBody(spaceId, ruleSO, doc as SignalSourceHit, mergeStrategy, true),
+        _source: buildBulkBody(
+          spaceId,
+          ruleSO,
+          doc as SignalSourceHit,
+          mergeStrategy,
+          true,
+          buildReasonMessage
+        ),
       },
     ]);
 

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/alerts.ts

@@ -193,6 +193,11 @@ export const alertsFieldMap: FieldMap = {
     array: false,
     required: true,
   },
+  'kibana.alert.reason': {
+    type: 'keyword',
+    array: false,
+    required: false,
+  },
   'kibana.alert.threat': {
     type: 'object',
     array: false,