Migrate Host risk and User risk UI to ECS schema

x-pack/plugins/security_solution/common/search_strategy/security_solution/risk_score/all/index.ts

@@ -25,33 +25,35 @@ export interface RiskScoreRequestOptions extends IEsSearchRequest {
 export interface HostsRiskScoreStrategyResponse extends IEsSearchResponse {
   inspect?: Maybe<Inspect>;
   totalCount: number;
-  data: HostsRiskScore[] | undefined;
+  data: HostRiskScore[] | undefined;
 }
 
 export interface UsersRiskScoreStrategyResponse extends IEsSearchResponse {
   inspect?: Maybe<Inspect>;
   totalCount: number;
-  data: UsersRiskScore[] | undefined;
+  data: UserRiskScore[] | undefined;
 }
 
-export interface RiskScore {
-  '@timestamp': string;
-  risk: string;
-  risk_stats: {
-    rule_risks: RuleRisk[];
-    risk_score: number;
-  };
+export interface RiskStats {
+  rule_risks: RuleRisk[];
+  calculated_score_norm: number;
+  multipliers: string[];
+  calculated_level: string;
 }
 
-export interface HostsRiskScore extends RiskScore {
+export interface HostRiskScore {
+  '@timestamp': string;
   host: {
     name: string;
+    risk: RiskStats;
   };
 }
 
-export interface UsersRiskScore extends RiskScore {
+export interface UserRiskScore {
+  '@timestamp': string;
   user: {
     name: string;
+    risk: RiskStats;
   };
 }
 
@@ -66,17 +68,23 @@ export type RiskScoreSortField = SortField<RiskScoreFields>;
 export const enum RiskScoreFields {
   timestamp = '@timestamp',
   hostName = 'host.name',
+  hostRiskScore = 'host.risk.calculated_score_norm',
+  hostRisk = 'host.risk.calculated_level',
   userName = 'user.name',
-  riskScore = 'risk_stats.risk_score',
-  risk = 'risk',
+  userRiskScore = 'user.risk.calculated_score_norm',
+  userRisk = 'user.risk.calculated_level',
 }
 
 export interface RiskScoreItem {
   _id?: Maybe<string>;
   [RiskScoreFields.hostName]: Maybe<string>;
   [RiskScoreFields.userName]: Maybe<string>;
-  [RiskScoreFields.risk]: Maybe<RiskSeverity>;
-  [RiskScoreFields.riskScore]: Maybe<number>;
+
+  [RiskScoreFields.hostRisk]: Maybe<RiskSeverity>;
+  [RiskScoreFields.userRisk]: Maybe<RiskSeverity>;
+
+  [RiskScoreFields.hostRiskScore]: Maybe<number>;
+  [RiskScoreFields.userRiskScore]: Maybe<number>;
 }
 
 export const enum RiskSeverity {
@@ -86,3 +94,6 @@ export const enum RiskSeverity {
   high = 'High',
   critical = 'Critical',
 }
+
+export const isUserRiskScore = (risk: HostRiskScore | UserRiskScore): risk is UserRiskScore =>
+  'user' in risk;

x-pack/plugins/security_solution/common/search_strategy/security_solution/risk_score/common/index.ts

@@ -33,4 +33,7 @@ export enum RiskQueries {
   kpiRiskScore = 'kpiRiskScore',
 }
 
-export type RiskScoreAggByFields = 'host.name' | 'user.name';
+export enum RiskScoreEntity {
+  host = 'host',
+  user = 'user',
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/risk_score/kpi/index.ts

@@ -6,7 +6,7 @@
  */
 
 import type { IEsSearchRequest, IEsSearchResponse } from '@kbn/data-plugin/common';
-import type { FactoryQueryTypes, RiskScoreAggByFields, RiskSeverity } from '../..';
+import type { FactoryQueryTypes, RiskScoreEntity, RiskSeverity } from '../..';
 import type { ESQuery } from '../../../../typed_json';
 
 import type { Inspect, Maybe } from '../../../common';
@@ -15,7 +15,7 @@ export interface KpiRiskScoreRequestOptions extends IEsSearchRequest {
   defaultIndex: string[];
   factoryQueryType?: FactoryQueryTypes;
   filterQuery?: ESQuery | string | undefined;
-  aggBy: RiskScoreAggByFields;
+  entity: RiskScoreEntity;
 }
 
 export interface KpiRiskScoreStrategyResponse extends IEsSearchResponse {

x-pack/plugins/security_solution/common/search_strategy/security_solution/users/common/index.ts

@@ -12,8 +12,8 @@ import type { UserEcs } from '../../../../ecs/user';
 export const enum UserRiskScoreFields {
   timestamp = '@timestamp',
   userName = 'user.name',
-  riskScore = 'risk_stats.risk_score',
-  risk = 'risk',
+  riskScore = 'user.risk.calculated_score_norm',
+  risk = 'user.risk.calculated_level',
 }
 
 export interface UserRiskScoreItem {

x-pack/plugins/security_solution/public/common/components/event_details/cti_details/host_risk_summary.test.tsx

@@ -23,11 +23,12 @@ describe('HostRiskSummary', () => {
           '@timestamp': '1641902481',
           host: {
             name: 'test-host-name',
-          },
-          risk: riskKeyword,
-          risk_stats: {
-            risk_score: 9999,
-            rule_risks: [],
+            risk: {
+              multipliers: [],
+              calculated_score_norm: 9999,
+              calculated_level: riskKeyword,
+              rule_risks: [],
+            },
           },
         },
       ],
@@ -67,11 +68,12 @@ describe('HostRiskSummary', () => {
           '@timestamp': '1641902530',
           host: {
             name: 'test-host-name',
-          },
-          risk: 'test-risk',
-          risk_stats: {
-            risk_score: 9999,
-            rule_risks: [],
+            risk: {
+              multipliers: [],
+              calculated_score_norm: 9999,
+              calculated_level: 'test-risk',
+              rule_risks: [],
+            },
           },
         },
       ],

x-pack/plugins/security_solution/public/common/components/event_details/cti_details/host_risk_summary.tsx

@@ -25,12 +25,12 @@ const HostRiskSummaryComponent: React.FC<{
         toolTipContent={
           <FormattedMessage
             id="xpack.securitySolution.alertDetails.overview.hostDataTooltipContent"
-            defaultMessage="Risk classification is displayed only when available for a host. Ensure {hostsRiskScoreDocumentationLink} is enabled within your environment."
+            defaultMessage="Risk classification is displayed only when available for a host. Ensure {hostRiskScoreDocumentationLink} is enabled within your environment."
             values={{
-              hostsRiskScoreDocumentationLink: (
+              hostRiskScoreDocumentationLink: (
                 <EuiLink href={RISKY_HOSTS_DOC_LINK} target="_blank">
                   <FormattedMessage
-                    id="xpack.securitySolution.alertDetails.overview.hostsRiskScoreLink"
+                    id="xpack.securitySolution.alertDetails.overview.HostRiskScoreLink"
                     defaultMessage="Host Risk Score"
                   />
                 </EuiLink>
@@ -56,7 +56,10 @@ const HostRiskSummaryComponent: React.FC<{
           <EnrichedDataRow
             field={i18n.HOST_RISK_CLASSIFICATION}
             value={
-              <RiskScore severity={hostRisk.result[0].risk as RiskSeverity} hideBackgroundColor />
+              <RiskScore
+                severity={hostRisk.result[0].host.risk.calculated_level as RiskSeverity}
+                hideBackgroundColor
+              />
             }
           />
         </>

x-pack/plugins/security_solution/public/common/components/risk_score_over_time/index.tsx

@@ -27,13 +27,14 @@ import { HeaderSection } from '../header_section';
 import { InspectButton, InspectButtonContainer } from '../inspect';
 import * as i18n from './translations';
 import { PreferenceFormattedDate } from '../formatted_date';
-import type { RiskScore } from '../../../../common/search_strategy';
+import type { HostRiskScore, UserRiskScore } from '../../../../common/search_strategy';
+import { isUserRiskScore } from '../../../../common/search_strategy';
 
 export interface RiskScoreOverTimeProps {
   from: string;
   to: string;
   loading: boolean;
-  riskScore?: RiskScore[];
+  riskScore?: Array<HostRiskScore | UserRiskScore>;
   queryId: string;
   title: string;
   toggleStatus: boolean;
@@ -81,7 +82,7 @@ const RiskScoreOverTimeComponent: React.FC<RiskScoreOverTimeProps> = ({
       riskScore
         ?.map((data) => ({
           x: data['@timestamp'],
-          y: data.risk_stats.risk_score,
+          y: (isUserRiskScore(data) ? data.user : data.host).risk.calculated_score_norm,
         }))
         .reverse() ?? [],
     [riskScore]

x-pack/plugins/security_solution/public/common/mock/global_state.ts

@@ -82,7 +82,7 @@ export const mockGlobalState: State = {
         hostRisk: {
           activePage: 0,
           limit: 10,
-          sort: { field: RiskScoreFields.riskScore, direction: Direction.desc },
+          sort: { field: RiskScoreFields.hostRiskScore, direction: Direction.desc },
           severitySelection: [],
         },
         sessions: { activePage: 0, limit: 10 },
@@ -106,7 +106,7 @@ export const mockGlobalState: State = {
         hostRisk: {
           activePage: 0,
           limit: 10,
-          sort: { field: RiskScoreFields.riskScore, direction: Direction.desc },
+          sort: { field: RiskScoreFields.hostRiskScore, direction: Direction.desc },
           severitySelection: [],
         },
         sessions: { activePage: 0, limit: 10 },

x-pack/plugins/security_solution/public/hosts/components/host_risk_information/index.tsx

@@ -129,9 +129,9 @@ const HostRiskInformationFlyout = ({ handleOnClose }: { handleOnClose: () => voi
         <EuiSpacer size="l" />
         <FormattedMessage
           id="xpack.securitySolution.hosts.hostRiskInformation.learnMore"
-          defaultMessage="You can learn more about host risk {hostsRiskScoreDocumentationLink}"
+          defaultMessage="You can learn more about host risk {HostRiskScoreDocumentationLink}"
           values={{
-            hostsRiskScoreDocumentationLink: (
+            HostRiskScoreDocumentationLink: (
               <EuiLink href={RISKY_HOSTS_DOC_LINK} target="_blank">
                 <FormattedMessage
                   id="xpack.securitySolution.hosts.hostRiskInformation.link"

x-pack/plugins/security_solution/public/hosts/components/host_risk_score_table/columns.tsx

@@ -67,7 +67,7 @@ export const getHostRiskScoreColumns = ({
     },
   },
   {
-    field: 'risk_stats.risk_score',
+    field: 'host.risk.calculated_score_norm',
     name: i18n.HOST_RISK_SCORE,
     truncateText: true,
     mobileOptions: { show: true },
@@ -84,7 +84,7 @@ export const getHostRiskScoreColumns = ({
     },
   },
   {
-    field: 'risk',
+    field: 'host.risk.calculated_level',
     name: (
       <EuiToolTip content={i18n.HOST_RISK_TOOLTIP}>
         <>

x-pack/plugins/security_solution/public/hosts/components/host_risk_score_table/index.tsx

@@ -16,7 +16,7 @@ import { useDeepEqualSelector } from '../../../common/hooks/use_selector';
 import { hostsActions, hostsModel, hostsSelectors } from '../../store';
 import { getHostRiskScoreColumns } from './columns';
 import type {
-  HostsRiskScore,
+  HostRiskScore,
   RiskScoreItem,
   RiskScoreSortField,
   RiskSeverity,
@@ -50,7 +50,7 @@ const IconWrapper = styled.span`
 const tableType = hostsModel.HostsTableType.risk;
 
 interface HostRiskScoreTableProps {
-  data: HostsRiskScore[];
+  data: HostRiskScore[];
   id: string;
   isInspect: boolean;
   loading: boolean;
@@ -63,8 +63,8 @@ interface HostRiskScoreTableProps {
 
 export type HostRiskScoreColumns = [
   Columns<RiskScoreItem[RiskScoreFields.hostName]>,
-  Columns<RiskScoreItem[RiskScoreFields.riskScore]>,
-  Columns<RiskScoreItem[RiskScoreFields.risk]>
+  Columns<RiskScoreItem[RiskScoreFields.hostRiskScore]>,
+  Columns<RiskScoreItem[RiskScoreFields.hostRisk]>
 ];
 
 const HostRiskScoreTableComponent: React.FC<HostRiskScoreTableProps> = ({

x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx

@@ -103,7 +103,7 @@ const HostsComponent = () => {
     }
 
     if (tabName === HostsTableType.risk) {
-      const severityFilter = generateSeverityFilter(severitySelection);
+      const severityFilter = generateSeverityFilter(severitySelection, 'host');
 
       return [...severityFilter, ...hostNameExistsFilter, ...filters];
     }

x-pack/plugins/security_solution/public/hosts/pages/navigation/host_risk_tab_body.tsx

@@ -13,6 +13,7 @@ import type { HostsComponentsQueryProps } from './types';
 import * as i18n from '../translations';
 import { HostRiskInformationButtonEmpty } from '../../components/host_risk_information';
 import { HostRiskScoreQueryId, useHostRiskScore } from '../../../risk_score/containers';
+import type { HostRiskScore } from '../../../../common/search_strategy';
 import { buildHostNamesFilter } from '../../../../common/search_strategy';
 import { useQueryInspector } from '../../../common/components/page/manage_query';
 import { RiskScoreOverTime } from '../../../common/components/risk_score_over_time';
@@ -86,7 +87,9 @@ const HostRiskTabBodyComponent: React.FC<
     [setOverTimeToggleStatus]
   );
 
-  const rules = data && data.length > 0 ? data[data.length - 1].risk_stats.rule_risks : [];
+  const lastHosttRiskItem: HostRiskScore | null =
+    data && data.length > 0 ? data[data.length - 1] : null;
+  const rules = lastHosttRiskItem ? lastHosttRiskItem.host.risk.rule_risks : [];
 
   return (
     <>

x-pack/plugins/security_solution/public/hosts/store/helpers.test.ts

@@ -40,7 +40,7 @@ export const mockHostsState: HostsModel = {
         activePage: DEFAULT_TABLE_ACTIVE_PAGE,
         limit: DEFAULT_TABLE_LIMIT,
         sort: {
-          field: RiskScoreFields.riskScore,
+          field: RiskScoreFields.hostRiskScore,
           direction: Direction.desc,
         },
         severitySelection: [],
@@ -79,7 +79,7 @@ export const mockHostsState: HostsModel = {
         activePage: DEFAULT_TABLE_ACTIVE_PAGE,
         limit: DEFAULT_TABLE_LIMIT,
         sort: {
-          field: RiskScoreFields.riskScore,
+          field: RiskScoreFields.hostRiskScore,
           direction: Direction.desc,
         },
         severitySelection: [],
@@ -124,7 +124,7 @@ describe('Hosts redux store', () => {
           severitySelection: [],
           sort: {
             direction: 'desc',
-            field: 'risk_stats.risk_score',
+            field: RiskScoreFields.hostRiskScore,
           },
         },
         [HostsTableType.sessions]: {
@@ -164,7 +164,7 @@ describe('Hosts redux store', () => {
           severitySelection: [],
           sort: {
             direction: 'desc',
-            field: 'risk_stats.risk_score',
+            field: RiskScoreFields.hostRiskScore,
           },
         },
         [HostsTableType.sessions]: {

x-pack/plugins/security_solution/public/hosts/store/helpers.ts

@@ -60,17 +60,21 @@ export const setHostsQueriesActivePageToZero = (state: HostsModel, type: HostsTy
   throw new Error(`HostsType ${type} is unknown`);
 };
 
-export const generateSeverityFilter = (severitySelection: RiskSeverity[]) =>
+export const generateSeverityFilter = (
+  severitySelection: RiskSeverity[],
+  entity: 'user' | 'host'
+) =>
   severitySelection.length > 0
     ? [
         {
           query: {
             bool: {
               should: severitySelection.map((query) => ({
                 match_phrase: {
-                  'risk.keyword': {
-                    query,
-                  },
+                  [entity === 'user' ? 'user.risk.calculated_level' : 'host.risk.calculated_level']:
+                    {
+                      query,
+                    },
                 },
               })),
             },

x-pack/plugins/security_solution/public/hosts/store/reducer.ts

@@ -59,7 +59,7 @@ export const initialHostsState: HostsState = {
         activePage: DEFAULT_TABLE_ACTIVE_PAGE,
         limit: DEFAULT_TABLE_LIMIT,
         sort: {
-          field: RiskScoreFields.riskScore,
+          field: RiskScoreFields.hostRiskScore,
           direction: Direction.desc,
         },
         severitySelection: [],
@@ -98,7 +98,7 @@ export const initialHostsState: HostsState = {
         activePage: DEFAULT_TABLE_ACTIVE_PAGE,
         limit: DEFAULT_TABLE_LIMIT,
         sort: {
-          field: RiskScoreFields.riskScore,
+          field: RiskScoreFields.hostRiskScore,
           direction: Direction.desc,
         },
         severitySelection: [],